Skip to main content

Linux Kernel CVE-2025-68234

HIGH
2025-12-16 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Information Disclosure Linux Red Hat Suse
7.8
CVSS 3.1 · Vendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Share

Severity by source

Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67) PRIMARY
7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
6.5 MEDIUM

Local unprivileged io_uring access gives PR:L/AV:L; hitting the specific timestamp-retry-with-nonempty-list race raises AC:H; info leak (C:H) and list corruption crash (A:H) are likely, controlled integrity impact lower (I:L).

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:H
4.0 AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:L/VA:H/SC:N/SI:N/SA:N
SUSE
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Red Hat
MEDIUM
qualitative

Primary rating from Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67).

CVSS VectorVendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

2
Analysis Generated
Jul 30, 2026 - 07:19 vuln.today
CVE Published
Dec 16, 2025 - 14:15 cve.org
HIGH 7.8

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

io_uring/cmd_net: fix wrong argument types for skb_queue_splice()

If timestamp retriving needs to be retried and the local list of SKB's already has entries, then it's spliced back into the socket queue. However, the arguments for the splice helper are transposed, causing exactly the wrong direction of splicing into the on-stack list. Fix that up.

AnalysisAI

Local privilege-relevant memory corruption in the Linux kernel's io_uring cmd_net timestamp-retrieval path arises from transposed arguments to skb_queue_splice(), causing SKBs to be spliced in the wrong direction between the socket queue and an on-stack list. Any local user able to issue io_uring network commands with timestamp retrieval could trigger the flawed splice, potentially leading to information disclosure (per source tagging) or broader list/memory corruption. There is no public exploit identified at time of analysis and EPSS is low (0.15%), so this is a code-quality/security hardening fix rather than an actively exploited threat.

Technical ContextAI

The affected component is io_uring, the Linux kernel's asynchronous I/O submission interface, specifically the cmd_net path that handles socket commands such as SO_TIMESTAMPING retrieval. When timestamp retrieval must be retried and a local SKB list already holds entries, the code splices that list back into the socket receive queue using skb_queue_splice(). The two queue arguments (source and destination) were transposed, so the splice occurred in exactly the wrong direction - into the on-stack list instead of back into the socket queue. Because sk_buff (SKB) queues are doubly-linked lists whose head lives on the kernel stack in this path, mis-splicing corrupts list linkage and can leave the on-stack head pointing at queue data that outlives the stack frame. No CWE was assigned in the input, but this is characteristically a linked-list/pointer-management error in the CWE-noninitialized/incorrect-pointer-handling family with information-disclosure and memory-corruption potential.

Affected ProductsAI

The Linux kernel is affected in versions containing the io_uring cmd_net timestamp-retry code path that calls skb_queue_splice() with transposed arguments; no exact vulnerable version range or CPE was provided in the input, so the precise affected range should be derived from the referenced stable-tree commits. The fix is recorded in the kernel stable git tree at https://git.kernel.org/stable/c/46447367a52965e9d35f112f5b26fc8ff8ec443d and https://git.kernel.org/stable/c/c85d2cfc5e24e6866b56c7253fd4e1c7db35986c. Distribution-specific backport status (Red Hat, Debian, Ubuntu, SUSE) is not included in the provided data and should be checked against each vendor's advisory.

RemediationAI

Upstream fix available (commit); a released, tagged patched kernel version is not independently confirmed from the provided data - apply the kernel stable-tree commits 46447367a52965e9d35f112f5b26fc8ff8ec443d and c85d2cfc5e24e6866b56c7253fd4e1c7db35986c (https://git.kernel.org/stable/c/46447367a52965e9d35f112f5b26fc8ff8ec443d and https://git.kernel.org/stable/c/c85d2cfc5e24e6866b56c7253fd4e1c7db35986c) or update to the distribution kernel package that incorporates them. Where immediate patching is not possible, reduce exposure by restricting who can run io_uring: set the sysctl kernel.io_uring_disabled=2 to disable io_uring for all users (trade-off: breaks applications that legitimately depend on io_uring), or =1 to limit it to a privileged group; alternatively constrain untrusted local/containerized workloads via seccomp filters that block the io_uring_setup/io_uring_enter syscalls (trade-off: application compatibility for sandboxed services). These controls close the local attack surface at the cost of io_uring-dependent performance features.

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
Image SLES12-SP5-Azure-BYOS Image SLES12-SP5-Azure-HPC-BYOS Image SLES12-SP5-EC2-BYOS Image SLES12-SP5-EC2-ECS-On-Demand Image SLES12-SP5-EC2-On-Demand Image SLES12-SP5-GCE-BYOS Image SLES12-SP5-GCE-On-Demand Affected
Image SLES12-SP5-Azure-SAP-BYOS Image SLES12-SP5-Azure-SAP-On-Demand Image SLES12-SP5-EC2-SAP-BYOS Image SLES12-SP5-EC2-SAP-On-Demand Image SLES12-SP5-GCE-SAP-BYOS Image SLES12-SP5-GCE-SAP-On-Demand Affected
SUSE Linux Enterprise Server 12 SP5-LTSS Fixed
SUSE Linux Enterprise Server LTSS Extended Security 12 SP5 Fixed
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected

Share

CVE-2025-68234 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy